tfroot-github/gh-dependabot.tf at main · makeitworkcloud/tfroot-github · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
# Dependabot version updates are managed centrally here so every active
# repository receives the same `.github/dependabot.yml` policy. Do not add
# hand-maintained dependabot configs to downstream repositories.
#
# OpenTofu roots use the dedicated `opentofu` ecosystem (GA since 2025-12-16),
# not `terraform`. Lock files are not git-tracked in these repos, so only
# version constraints in .tf files are bumped.
#
# Deliberately not covered:
# - pre-commit hook revisions: owned by images/tfroot-runner/pre-commit-config.yaml
# - tool ARG pins in images/*/Containerfile: Dependabot only updates FROM tags
# - Kubernetes image tags in kustomize-cluster: no Dependabot ecosystem exists

locals {
  dependabot_docker_directories = ["gh-cli", "tfroot-runner"]

  dependabot_configs = {
    for name, repository in local.repositories : name => {
      version = 2
      updates = concat(
        [for ecosystem in repository.dependabot_ecosystems : {
          package-ecosystem = ecosystem
          directory         = "/"
          schedule = {
            interval = "daily"
          }
          groups = {
            (ecosystem) = {
              patterns = ["*"]
            }
          }
        } if ecosystem != "docker"],
        [for directory in local.dependabot_docker_directories : {
          package-ecosystem = "docker"
          directory         = "/${directory}"
          schedule = {
            interval = "daily"
          }
          groups = {
            docker = {
              patterns = ["*"]
            }
          }
        } if contains(repository.dependabot_ecosystems, "docker")]
      )
    }
    if length(repository.dependabot_ecosystems) > 0
  }
}

resource "github_repository_file" "dependabot" {
  for_each = local.dependabot_configs

  repository          = github_repository.repositories[each.key].name
  file                = ".github/dependabot.yml"
  content             = "# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.\n${yamlencode(each.value)}"
  commit_message      = "chore: sync managed dependabot configuration"
  overwrite_on_create = true

  # These attributes are creation/commit metadata, not the centrally managed
  # file content. Ignoring imported values avoids a protected-branch write when
  # adopting a PR-seeded file; future content changes remain managed.
  lifecycle {
    ignore_changes = [
      commit_message,
      overwrite_on_create,
    ]
  }
}

locals {
  # Caller for the dependabot-notify reusable workflow in shared-workflows.
  # It is named _dependabot-notify.yml there because this root owns the caller
  # path in every repository, including shared-workflows itself.
  dependabot_notify_workflow = templatefile("${path.module}/templates/dependabot-notify.yml.tftpl", {})
}

resource "github_repository_file" "dependabot_notify" {
  for_each = local.dependabot_configs

  repository          = github_repository.repositories[each.key].name
  file                = ".github/workflows/dependabot-notify.yml"
  content             = local.dependabot_notify_workflow
  commit_message      = "chore: sync managed dependabot notification workflow"
  overwrite_on_create = true

  # See github_repository_file.dependabot above. The workflow content remains
  # managed; only imported creation/commit metadata is ignored.
  lifecycle {
    ignore_changes = [
      commit_message,
      overwrite_on_create,
    ]
  }
}